Cloud Engineer Interview Questions
120 questions across 5 categories
Cloud-provider-specific depth — AWS, Azure, GCP — architecture, cost, and the platform-specific judgment calls each provider demands.
A just-deployed App Service release is causing production errors and needs an immediate rollback. Is swapping back to the previous slot genuinely faster than redeploying the old package?
IntermediateAzureApp Service6 min
An App Service using Managed Identity to call a storage account worked fine for months. After a Private Endpoint was added to that storage account, the App Service started failing to reach it. Why?
AdvancedAzureApp ServiceBlob Storage7 min
How would you decide between App Service, Azure Functions, and AKS for a new event-driven workload, beyond just 'Functions is for small things'?
IntermediateAzureApp ServiceAzure Functions7 min
A Consumption-plan Azure Function triggered by new Blob Storage uploads is intermittently missing events during bursty upload periods — why, and how do you fix it?
AdvancedAzureAzure FunctionsBlob Storage7 min
How would you design a zero-downtime, safely-rollback-able release process for an App Service using deployment slots?
AdvancedAzureApp Service8 min
An App Service deployment tested perfectly in staging, but broke immediately in production right after a slot swap. What's the most likely cause, and how do you investigate it?
IntermediateAzureApp Service6 min
An Azure Function on the Consumption plan is getting cold-start complaints, and someone suggests 'just move it to Premium.' When does that actually pay for itself, versus just adding cost?
IntermediateAzureAzure Functions6 min
Right after scaling an App Service plan from one instance to several, users started randomly getting logged out and losing cart contents. What changed, and how would you fix it properly?
IntermediateAzureApp Service6 min
A CI/CD pipeline that's authenticated successfully for months suddenly starts failing with an authentication error, right after the security team enabled a new Conditional Access policy. What's happening?
AdvancedAzure7 min
A new Key Vault needs a permission model — should you use Azure RBAC or the older vault access policies, and why does Key Vault even have two separate systems for this?
IntermediateAzureKey Vault6 min
How would you design secret rotation for a live, high-traffic application backed by Key Vault, so rotating a credential never causes a production outage?
ExpertAzureKey Vault8 min
A Function App using Managed Identity to read a Key Vault secret works most of the time, but intermittently fails on startup with an authorization error. How do you actually diagnose this?
AdvancedAzureKey Vault7 min
An Azure DevOps pipeline currently authenticates to Azure using a service principal with a stored client secret. Why would you migrate to a managed identity instead, and what are the actual limits of doing so?
IntermediateAzure7 min
You need to control outbound traffic from a VNet, including blocking access to specific malicious domains and inspecting traffic content. Are Network Security Groups sufficient, or do you need Azure Firewall?
IntermediateAzure7 min
An app needs to reach an Azure Storage account without traffic crossing the public internet. Should you use a Service Endpoint or a Private Endpoint, and what's the actual security difference?
IntermediateAzure7 min
A user was granted Contributor access to a single resource group, but they can see and modify resources across the entire subscription. How is that possible, and how do you audit for this?
IntermediateAzure6 min
How would you design a resource group and subscription structure for an organization with 15 teams, balancing isolation, cost tracking, and not making every team manage their own subscription?
IntermediateAzure8 min
A CI/CD pipeline that's deployed successfully for two years suddenly fails every run overnight, with no recent pipeline or code changes. How do you diagnose it, and prevent it happening silently again?
IntermediateAzure6 min
A lifecycle policy quietly moved a set of blobs to Archive tier months ago, and now someone urgently needs one back within the hour. What are your actual options?
AdvancedAzureBlob Storage7 min
A new project is choosing between Blob Storage's Hot, Cool, Cold, and Archive tiers for its data. How would you actually decide, and what's the risk of getting it wrong?
BeginnerAzureBlob Storage6 min
A storage account's firewall was locked down to specific VNets for security, and now diagnostic logging and a few other first-party Azure integrations silently stopped working. What's actually happening?
AdvancedAzureBlob Storage6 min
A compliance requirement says certain records must be provably unmodifiable for seven years. How would you design this with Blob Storage's immutability features, and what breaks if you choose the wrong policy type?
AdvancedAzureBlob Storage7 min
How would you choose a Storage account's replication setting (LRS, ZRS, GRS, or GZRS) for a workload that genuinely needs regional resilience?
IntermediateAzureBlob Storage7 min
An app authenticates to Blob Storage using a long-lived SAS token embedded in configuration. Why move it to Managed Identity, and what does a SAS actually give up that Managed Identity doesn't?
IntermediateAzureBlob Storage7 min